Adversarial detection: for adversarial detection, we generate adversarial attacks on the validation partition of ImageNet against a pre-trained ResNet50 using three popular attacks: PGD [1]}, CW [2]}, and FGSM [3]}. We follow the tuning suggested by [4]}, i.e. PGD: norm \(L_\infty \) , \(\delta =0.02\) , step size \(0.002\) , 50 iterations; CW: norm \(L_2\) , \(\delta =0.10\) , learning rate of \(0.03\) , and 50 iterations; FGSM: norm \(L_\infty \) , \(\delta =0.05\) . We compare our results with ODIN [5]}, which achieves good performances in [6]} despite not being designed for adversarial detection, and to [7]}. Most other existing adversarial detection methods assume access to adversarial samples during training (see Section ). While both of these works use adversarial samples to tune hyperparameters, we additionally propose a modification to [7]} to perform auto-calibration based on the mean and variance of the criterions on clean data, similarly to CADet's calibration step. We report the AUROC scores in Table REF  and illustrate them with ROC curves against each anomaly type in Figure REF .
